wireguard

1.0.20260223-r0-ls127

WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.

docker pull lscr.io/linuxserver/wireguard:latest

Quick start

Generated from the image's own configuration. Replace the /path/to folders with real paths on your host.

Include optional settings

---
services:
  wireguard:
    image: lscr.io/linuxserver/wireguard:latest
    container_name: wireguard
    cap_add:
      - NET_ADMIN
      - SYS_MODULE # optional
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - SERVERURL=wireguard.domain.com # optional
      - SERVERPORT=51820 # optional
      - PEERS=1 # optional
      - PEERDNS=auto # optional
      - INTERNAL_SUBNET=10.13.13.0 # optional
      - ALLOWEDIPS=0.0.0.0/0 # optional
      - PERSISTENTKEEPALIVE_PEERS= # optional
      - LOG_CONFS=true # optional
    volumes:
      - /path/to/wireguard/config:/config
      - /lib/modules:/lib/modules # optional
    ports:
      - 51820:51820/udp
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    restart: unless-stopped

Parameters

Ports
Port	Function	Required
51820:51820/udp	wireguard port	required

Environment variables
Variable	Function	Required
PUID=1000	User ID	required
PGID=1000	Group ID	required
TZ=Etc/UTC	Timezone	required
SERVERURL=wireguard.domain.com	External IP or domain name for docker host. Used in server mode. If set to `auto`, the container will try to determine and set the external IP automatically	optional
SERVERPORT=51820	External port for docker host. Used in server mode.	optional
PEERS=1	Number of peers to create confs for. Required for server mode. Can also be a list of names: `myPC,myPhone,myTablet` (alphanumeric only)	optional
PEERDNS=auto	DNS server set in peer/client configs (can be set as `8.8.8.8`). Used in server mode. Defaults to `auto`, which uses wireguard docker host's DNS via included CoreDNS forward.	optional
INTERNAL_SUBNET=10.13.13.0	Internal subnet for the wireguard and server and peers (only change if it clashes). Used in server mode.	optional
ALLOWEDIPS=0.0.0.0/0	The IPs/Ranges that the peers will be able to reach using the VPN connection. If not specified the default value is: '0.0.0.0/0, ::0/0' This will cause ALL traffic to route through the VPN, if you want split tunneling, set this to only the IPs you would like to use the tunnel AND the ip of the server's WG ip, such as 10.13.13.1.	optional
PERSISTENTKEEPALIVE_PEERS=	Set to `all` or a list of comma separated peers (ie. `1,4,laptop`) for the wireguard server to send keepalive packets to listed peers every 25 seconds. Useful if server is accessed via domain name and has dynamic IP. Used only in server mode.	optional
LOG_CONFS=true	Generated QR codes will be displayed in the docker log. Set to `false` to skip log output.	optional

Volumes
Path	Function	Required
/config	Contains all relevant configuration files.	required
/lib/modules	Path to host kernel module for situations where it's not already loaded.	optional

Other settings
Setting	Function	Required
cap_add: NET_ADMIN	Neccessary for Wireguard to create its VPN interface.	required
cap_add: SYS_MODULE	Neccessary for loading Wireguard kernel module if it's not already loaded.	optional
sysctls: net.ipv4.conf.all.src_valid_mark=1	Required for client mode.	required

Architectures

Pulling :latest picks the right one for your host automatically.

x86_64amd64-latest
arm64arm64v8-latest

Changelog

5 Jul 2026
Rebase to Alpine 3.24.
24 Jan 2026
Rebase to Alpine 3.23 again as openresolv alpine 3.23 package has now been updated.
22 Jan 2026
Revert to Alpine 3.22 due to resolvconf bug.

Writing

Posts about wireguard

16 Nov 20233 min read

Advanced Wireguard Hub

In a couple of prior articles (here and here) we showcased the capabilities of our WireGuard Docker container with some real world examples. At the time, our WireGuard container…

14 Feb 20239 min read

Advanced Wireguard Container Routing

WireGuard on VPS to achieve split tunneling so we can connect through a commercial VPN while maintaining access to homelab when remote

4 May 202214 min read

Routing Docker Host And Container Traffic Through WireGuard

Introduction Routing All Traffic Through WireGuard Routing Docker Container Traffic Through WireGuard Setting up a container to use the WireGuard container's network stack Routing…

Browse all

unifi-network-application

10.6.106-ls151

The unifi-network-application software is a powerful, enterprise wireless software engine ideal for high-density client deployments requiring low latency and high uptime performance.

899K1.1Karm64

duckdns

8d8f7eba-ls94

duckdns is a free service which will point a DNS (sub domains of duckdns.org) to an IP of your choice. The service is completely free, and doesn't require reactivation or forum posts to maintain its existence.

772K376arm64

ddclient

v4.0.0-ls236

ddclient is a Perl client used to update dynamic DNS entries for accounts on Dynamic DNS Network Service Provider. It was originally written by Paul Burry and is now mostly by wimpunk. It has the capability to update more than just dyndns and it can fetch your WAN-ipaddress in a few different ways.

388K182arm64

adguardhome-sync

v0.9.4-ls178

adguardhome-sync is a tool to synchronize AdGuardHome config to replica instances.

188K65arm64